CVE-2023-50266mediumCWE-918

CVE-2023-50266: falha de média gravidade em morpheus65535 bazarr

Bazarr Blind Server-Side Request Forgery (SSRF) in the /test/<protocol>/ endpoint

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar bazarr

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5.3epss 0.6%
Bazarr manages and downloads subtitles. In version 1.2.4, the proxy method in bazarr/bazarr/app/ui.py does not validate the user-controlled protocol and url variables and passes them to requests.get() without any sanitization, which leads to a blind server-side request forgery (SSRF). This issue allows for crafting GET requests to internal and external resources on behalf of the server. 1.3.1 contains a partial fix, which limits the vulnerability to HTTP/HTTPS protocols.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Produtos afetados
morpheus65535 · bazarr
CVEs relacionadas — morpheus65535 bazarr

No mesmo produto, das mais perigosas para as menos.

CVE-2023-50265HIGHBazarr Arbitrary file read in /api/swaggerui/static endpointEPSS 0.9%CVE-2023-50264HIGHBazarr Arbitrary file read in /system/backup/download/ endpointEPSS 0.9%CVE-2026-61826CRITICALBazarr: Plex OAuth API namespace is entirely unauthenticated, allowing config tampering, integration takeover and server-side request forgeryEPSS 0.3%